APT_OceanLotus_ISSUTIL_Sep18

Rule Info

Name
APT_OceanLotus_ISSUTIL_Sep18
Author
Florian Roth
Description
Detects ISSUTIL used by Ocean Lotus APT group
Score
75
Reference
Internal Research
Date
2018-09-11
Minimum Yara
1.7
Rule Hash
2011e9a398f1028c0f136c811077d2e0
Tags
['APT', 'EXE', 'FILE', 'G0050']
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
4
Suspicious (< 10 engines)
0
Clean (0 engines)
94

Rule Matches

Timestamp
Positives
Total
Hash
VT
2019-07-31 01:25:04
0
70
b89f6924c2ac3bd43b0219f73e682e90e352357354b5c694ca7c648ed1558eb4
2019-07-31 01:19:06
0
65
d71e0dc14a71fe33c0037c712861c8d17f30e33c0380c746b8b67cb2c38112d2
2019-07-31 01:19:05
0
65
6f8f729fc159976e9d8d1956d646f721a6827c22876a6b893e75b19d719f92ac
2019-07-31 01:18:38
0
68
6ced08348bc6bd60a57e0e1f7da0212819400fb23f5b11b0793d0d01faafd00e
2019-07-31 01:18:37
0
69
4cb60786ceb4d40ed985fca809ecf9a26c9303326c9cb55482d80e181fb0cd8c
2019-07-31 01:18:36
0
69
463878798a42fc93fd3d512758e65a9869de6c9163ce5fa86dbf352c26579641
2019-07-31 01:18:06
0
69
238981351723de09d5a5ecac3faca07df40d52b2c00cece939606a7976447eb1
2019-07-31 01:18:04
0
70
ffe59b5a47231919142dd90b7265e565f8b4457b37eddf747002057aacab77b2
2019-07-31 01:17:37
0
69
0afdb696becb1b0d6d8c8d949a1f402e187bffe7ac4eff43060aefff27104f8d
2019-07-31 01:17:05
0
67
30258756797b27d3e9a460ea693d3164bf03f6e21240fc209ad613c7649bef04
2019-07-31 01:16:37
0
66
c449521443ec7e8516900b047a414440f37878ab00156d7790bb76b057043e8b
2019-07-31 01:16:36
0
66
214bed06a57579a68a92457c05c1e3bf4a23362eda309e3b4d8f9c9ca9986047
2019-07-31 01:16:05
0
70
4ba177dc74ab4a2ec03b97248cfec7cd8dacfc37a479925ec334062e37b894aa
2019-07-31 01:15:39
0
70
cf5e7aaebc8d3cc53dd99072d64a9e3d7d897a9034306c3f0618d5c35ab5334e
2019-07-31 01:15:38
0
66
07a7d69b9e76d69a1f39e6d7505b9011adcecb45f41d3334f3f4417df4b8b105
2019-07-31 01:15:38
0
69
7596028d01d7a7f09185ea7f9abc5bc82b7e33c0f3cab539391a9da56c086ea3
2019-07-31 01:15:36
0
70
7de7a87b7928113d3da22b255c794366fd42f79d7c2a09a8dd58bf43d90f8504
2019-07-31 01:15:35
0
70
a1448ed5a44ca0c176030d87a9d229a27426ab30ebf7fd3503f94633b40f9a32
2019-07-31 01:15:07
0
66
3b124a82a6dcad7e85f18a77af87214b1fd474fe58d1061f01e925e5465d7796
2019-07-31 01:15:04
0
70
46f3472c6b7d01b1e2f110c3ab16166fed4b41a333ee061657e15c01f9f884a0
2019-07-31 01:14:38
0
70
6d45293e2b44956d1d5f7a208a5037cddf67aaf0ac4902dd1c788fcfbedd806a
2019-07-31 01:14:36
0
70
8caf6cc933becc83480af65ffddd23b6dc1e481176a83e9ae667a6c1ba2d67ce
2019-07-31 01:14:36
0
68
a4db037d4e9dffa06973b22bbd7cead7a09d9300d8c1f734c93dd3d0fde545c5
2019-07-31 01:14:10
0
68
89e3082c853d1604e767d778818784f305bd49100d2d4a7ba6cc8c34ea5caf87
2019-07-31 01:14:08
0
68
f06754dde92c98ca6ef28a912def91cc2b388f4f683a0cc30af63c5f4a24fcdc
2019-07-31 01:14:07
0
68
0c1e4806196ba3928f0ad84f07ac97be92a0d4b0a18cf8fabf71282f688d46eb
2019-07-31 01:14:06
0
70
759dda8e325207c389a8dd312ef4a6a726f5e36bf9498563e8adaf1ae31ac9f0
2019-07-31 01:14:05
0
68
16ac2c078a9cb656c61a083e3c34f1d7acd535b89b21852c76d01380c1ec9de2
2019-07-31 01:13:35
0
69
f7242d924eb03aeac565c53cabfcc893cea6048661985fa052359d539fbddee5
2019-07-31 01:13:04
0
68
6d6d5e2763f5a5d10813cc48b12cdd3f6ac207885c51661bad12034854378cfb
2019-07-31 01:13:03
0
68
d3c8d049a88feda1c6fff86d31fcbdf1076fd2c5293fc39fa729c1ed871313ae
2019-07-31 01:12:37
0
70
7d6dc5906aa29297596d3634fad48ac1d1d259b027ebe7af41ae874c693ca257
2019-07-31 01:12:35
0
69
c00d731f3ee025cd585e733657540614db3d7d7c1fec91c468e8632f67049ca8
2019-07-31 01:12:07
0
68
01161ac90366419d9b956c0da80bd5ff2514ab1691aca7c21bf33fb30bbf7eee
2019-07-31 01:12:06
0
69
afb20c290dfc0f357835c9d529061e40b2a6e3095465ab95bf12378db167e2c3
2019-07-31 01:12:05
0
70
9edc4f492e01ca5de60a92f94efad266cb7d1c090c0eeff794725bb8f4d86c5e
2019-07-31 01:11:37
0
69
00b8525e80800874d4a300477ce7357a7a12b2626707ef85a24238c91133e6b1
2019-07-31 01:11:36
0
69
5482cf6b9a16f6d0f3d0760e4da28d99a6b272916143016d2fc8772bbd9faed0
2019-07-31 01:11:35
0
69
526f060e506445c61837cd6dc1281a04da9599545981602d2d94f82d82f2e824
2019-07-31 01:11:05
0
70
c38b9ee86b1bedaa28bcbffe8e02b6312d9b19f9baf22e2397d898019b5bfcec
2019-07-31 01:11:05
0
69
81fbfa958476201b4af1f0ce3b9e972f54c203d6d8a3749edf8c1f6612b84da3
2019-07-31 01:11:04
0
68
3ba915a56edc8af05818fee37f9ccccd7601cb4418343625d94cc39a3e065074
2019-07-31 01:10:39
0
69
a9c57ed12880633e2a78a19c5bbceda71164a609de396d05649967624ab4a16f
2019-07-31 01:10:10
0
69
b0fdefdce4589e694a5641b1380c7fb9afb7fbb54cafa6331c183736908f5c1a
2019-07-31 01:10:09
0
70
86c29fbc94d010d661f462482beea15a96a52fec4f74920742a12ff31901fe12
2019-07-31 01:10:09
0
70
970a2df302aa704cf7465528326cddbcc8d1b16dc5a73d145a09ed01e4367a2c
2019-07-31 01:10:08
0
64
3235db151a2b7fe291386fbf07b0cbeb882cfbbb2d5ea75cfbfa681b222e63f5
2019-07-31 01:10:07
0
71
88a7d8e8a8c2a71b2849b1eb00b6ba2997ab1b82d954ccd9ca63119094f516c4
2019-07-31 01:09:40
0
70
fe37d6717c8e4d1cc302910e263e91ab1def8350f14ea83180bc04f25faf2f79
2019-07-31 01:09:39
0
68
88b5f5594cf66e32a6e0ce5f466dea5d6f5b6cf47eb068935d6bbb7a6fc9a66e
2019-07-31 01:09:38
0
67
c6da8973f3c348a667714905a2003d81b6d20b9f3313ef8fe06d2a390ac1dc28
2019-07-31 01:09:37
0
70
89d5d3e12304c4c72262b20149593e5643335e5272824f8ae5406d4b7485d8f5
2019-07-31 01:09:35
0
67
fb3c2e56f318e43806b7deb3cee89e02ee2dd6fde80f7bd677447a23df973658
2019-07-31 01:09:06
0
71
b809951792d506c374b022feeb3c28c8487f42e23c3b01006cf8454cb8191d99
2019-07-31 01:09:05
0
70
ad9e6655eb2f1d08c89df8fd83673c6f0c742feb6f2d55be5c0a431e9ef993d2
2019-07-31 01:08:41
0
69
56c317a14703ccbf794aa15b84b5f055d03009d9d3c5221f2097e3a933a0206b
2019-07-31 01:08:40
0
70
58501432cfca8e9ecee28b53db554e3bc98501e2ad54ff7bebc36776f609900a
2019-07-31 01:08:39
0
70
b61e90079ba7d826e439701acf20cfa701346a7db8ad628959703da07d16f4f9
2019-07-31 01:08:38
0
66
8e893f85ccbbcc3fadde4df61bb663865daa3c69cc163da75c3ff54b1a531351
2019-07-31 01:08:37
0
66
b992bf62b3f517b38105732a84ab060871e2943f6cdfad940a4cf32e43abdf25
2019-07-31 01:08:35
0
70
19d76386feb733e4f24f8dc60311001cb3d1d826200f70f9f290a903dcf99886
2019-07-31 01:08:07
0
70
525e34eefb7dbc7730a4add078cef9fe5040cf5a95ffd719d9b1a2d9dd402a6b
2019-07-31 01:08:06
0
70
3f1c30903fb345dbdd3279a4782eaa9fe5011b5ce348ce84eed08808f2089592
2019-07-31 01:08:05
0
69
8180108b213c533e152867bd56f0215cbd4130551f9068d370b7faa5e9346ceb
2019-07-31 01:08:05
0
63
f5d93b06b8fc8228ab0fdfc7a0be5f705ffcadcb4b3653e3d5738fe3a5a50cf0
2019-07-31 01:07:36
0
69
e9cfb73e913c3beab92f334ae06b2196337d4690384ba7a39c34a26ba567107c
2019-07-31 01:07:06
0
69
b57714529867a964ab9b2f5d949a8300d94616864d2f0ed88ad93019cc5440bf
2019-07-31 01:06:07
0
70
6f5702645a49e08e85a4ab5b8b5336c3d569eee9cce458ff8fdc6b1da9f20143
2019-07-31 01:05:37
0
68
0be65ffe767a37240c5b9cdcf05f1031282eaa4913548d2391f9a1a475aade3e
2019-07-31 01:05:09
0
68
1d17ff1f9ea24d1a8c41e28853d7416c25b101b80d75480e139fcd3716ad9d87
2019-07-31 01:05:07
0
69
7d6e3f9d3f5f4e1846d042380f20741d5cd52f600dcb2193071aa6f3fbaf2bdf
2019-07-31 01:05:06
0
69
286eeca93b49c1fed4ab35c5ad3f5841b171873ce9d6fa456e9ea646cddda79c
2019-07-31 01:04:36
0
70
07d4edbfdbd1122aead5dfb2e463f7f878ce58761a457e258aa7b4dbd635f1c2
2019-07-31 01:04:35
0
71
aaa2a69edd28fc270fb0771d059e3a25b7907de3685ca8a50c979013f2827821
2019-07-31 01:04:08
0
70
f67c0389d2f7db91891886cba14932db10531ea47af5f85b75fb32aa4db9b040
2019-07-31 01:04:07
0
71
bbdb161025a26a05d448047a6248abb8226961cf07bf7d1dadbee447dc19b0f3
2019-07-31 01:04:06
0
71
de7a7022db2db4d600b25781610d274652b2d5e4c231d169518a30e762ca1367
2019-07-31 01:04:05
0
71
c76b56b7853a9095c1ca98e1127e5dbd0f37b966639e8693718baf1a67f23b85
2019-07-31 01:04:04
0
67
d49fe5aac4e0351a5aba73198fc6c5cb355e6b180ba969d259a0e3747770b71c
2019-07-31 01:03:34
0
71
836c0832b40d70cb43f1a5474ff6a45e97485993764a2980cb0395a6e156f348
2019-07-31 01:03:09
0
70
96a5948b40f61523743876039b1f124c09e5e65aa6c05fedb9be8b122f7148ed
2019-07-31 01:03:07
0
70
7e21e6dfebedd41ec905001b1457bec9d8e6438205a8efd3a0fc8741b3f4e89f
2019-07-31 01:03:06
0
70
abfe15acc4266da7994bd0b3396a2083c6562e4a65e3394afe1096f2eeadad17
2019-07-31 01:03:05
0
70
f71182df4209b12432e29a162b5fcfb2dd4893cea105239a954a88735ea41a6e
2019-07-31 01:03:04
0
70
c898d9814b5e363ae2b18c7af099b014f0754c7d7a7817dec321e46f239a3214
2019-07-31 01:02:38
0
70
2fb32fc7d4b9df9191934d10228984ea5b4702a5bbd7a319aed9cd3af6901f87
2019-07-31 01:02:35
0
69
e6fba96262933ceaddd158671c240f743ab2b431e53153016d12d1f0186139ad
2019-07-14 13:18:14
0
65
2a664c99c31975df171433fbe2abacd9055666f6d93784cf259035b55bf762dd
2019-07-06 10:50:05
0
69
878f261d706f094298612dd411c1cbdf00d90058c03dccdabe6019a054c69519
2019-05-12 01:15:04
0
71
020d647a6a4a389420e1a8cf83eb14bb9116396a27858678a5f4a6bd4ecdeefb
2019-05-11 16:40:05
0
70
642530ca8d72f8a5366dc309304bf3610b4017801712168b5227ef32d7b20c15
2019-04-09 06:23:05
63
68
744e9e7ce7432f075fe51a4312d39b87c6b9140cdf198b2f2f6b29f325cfb5d5
2019-03-31 06:26:06
61
67
d403d615e67b1207347da9c6fc5fe668bbae2704b49e7f8e5a76d1d9904806cb
2019-03-06 21:27:09
0
69
007d1a1aa210a05717f530ecc9d4aade984485e4273eef48c74f065173f655dd
2018-12-24 18:17:09
0
69
aa5ff1126a869b8b5a0aa72f609215d8e3b73e833c60e4576f2d3583cc5af4f4
2018-12-24 14:11:04
15
68
4e692aa0c2b858917235b4cc2befe649c1fc3df90d6c42d0f329cde57156d752
2018-12-12 21:11:06
0
69
3ed31782f87180f0494d0926320dd47412b02d3dd25cdc55e3d02908f1045628
2018-11-19 04:01:05
48
65
bdc85029de6593f102288456f5dd2cc76abb5f67ba1af682a55d9b5899733ade

Rule Matches per Month (last 24 months)